126 if ((
Cookie & 0xF0000000) ||
129 DPRINT1(
"LdrUnlockLoaderLock() called with an invalid cookie!\n");
325 RtlInitEmptyUnicodeString(&DllString2,
NULL, 0);
342 RedirectedDll =
TRUE;
365 DPRINT1(
"[%p, %p] LDR: Recursive DLL Load\n",
368 DPRINT1(
"[%p, %p] Previous DLL being loaded \"%wZ\"\n",
372 DPRINT1(
"[%p, %p] DLL being requested \"%wZ\"\n",
380 DPRINT1(
"[%p, %p] LDR: No DLL Initializer was running\n",
386 DPRINT1(
"[%p, %p] DLL whose initializer was currently running \"%wZ\"\n",
415 "LDR: %s - failing because LdrpLoadDll(%wZ) returned status %x\n",
482 NextEntry = ListHead->
Flink;
483 while (NextEntry != ListHead)
504 NextEntry = NextEntry->
Flink;
511 "LDR: %s() exiting 0x%08lx\n",
538 RtlInitEmptyUnicodeString(&DllString1,
NULL, 0);
539 RtlInitEmptyUnicodeString(&RawDllName,
NULL, 0);
540 RedirectName = *DllName;
541 pRedirectName = &RedirectName;
549 if (DllHandle) *DllHandle =
NULL;
555 DPRINT1(
"Flags are invalid or no DllHandle given\n");
586 RedirectedDll =
TRUE;
595 ASSERT(pRedirectName == &RedirectName);
644 p1 = pRedirectName->
Buffer;
653 else if (*p1 ==
L'\\')
660 if (!(p2) || (*p2 ==
L'\\') || (*p2 ==
L'/'))
720 DPRINT1(
"LDR: LdrGetDllHandleEx, searching for %wZ from %ws\n",
775 if (DllHandle) *DllHandle = LdrEntry->
DllBase;
854 DPRINT(
"LdrVerifyImageMatchesChecksum() called\n");
869 DPRINT1 (
"NtCreateSection() failed (Status 0x%x)\n",
Status);
888 DPRINT1(
"NtMapViewOfSection() failed (Status 0x%x)\n",
Status);
901 DPRINT1(
"NtMapViewOfSection() failed (Status 0x%x)\n",
Status);
931 if (ImageCharacteristics)
947 while (ImportData->
Name)
994 DPRINT(
"LdrQueryProcessModuleInformation() called\n");
1002 if (
Size < UsedSize)
1008 ModuleInformation->NumberOfModules = 0;
1009 ModulePtr = &ModuleInformation->Modules[0];
1026 if (UsedSize >
Size)
1041 InitListHead = &
NtCurrentPeb()->Ldr->InInitializationOrderModuleList;
1042 InitEntry = InitListHead->
Flink;
1044 while (InitEntry != InitListHead)
1052 if (InitModule == Module)
break;
1055 InitEntry = InitEntry->
Flink;
1077 if (ModuleInformation)
1078 ModuleInformation->NumberOfModules++;
1087 *ReturnedSize = UsedSize;
1097 DPRINT(
"LdrQueryProcessModuleInformation() done\n");
1138 ListHead = &
NtCurrentPeb()->Ldr->InLoadOrderModuleList;
1139 ListEntry = ListHead->
Flink;
1140 while (ListHead != ListEntry)
1171 ListEntry = ListEntry->
Flink;
1330 RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED
ActCtx;
1332 ULONG ComSectionSize;
1394 InInitializationOrderLinks);
1395 NextEntry = NextEntry->
Blink;
1406 DPRINT1(
"(%lu) [%ws] %ws (%lx) deinit %p\n",
1422 CurrentEntry = LdrEntry;
1445 CurrentEntry =
NULL;
1455 CurrentEntry = LdrEntry;
1472 DPRINT1(
"LDR: Calling deinit %p\n", EntryPoint);
1494 DPRINT1(
"WARNING: Exception 0x%x during LdrpCallInitRoutine(DLL_PROCESS_DETACH) for %wZ\n",
1505 CurrentEntry =
NULL;
1510 NextEntry = UnloadList.
Flink;
1511 while (NextEntry != &UnloadList)
1515 NextEntry = NextEntry->
Flink;
1516 CurrentEntry = LdrEntry;
1538 DPRINT1(
".NET Images are not supported yet\n");
1560 DPRINT1(
"We don't support Hotpatching yet\n");
1607 #define STATUS_MUI_FILE_NOT_FOUND ((NTSTATUS)0xC00B0001L) ULONG AlternateResourceModuleCount
#define LDR_LOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS
NTSTATUS NTAPI LdrGetDllHandleEx(IN ULONG Flags, IN PWSTR DllPath OPTIONAL, IN PULONG DllCharacteristics OPTIONAL, IN PUNICODE_STRING DllName, OUT PVOID *DllHandle OPTIONAL)
DECLSPEC_NORETURN NTSYSAPI VOID NTAPI RtlRaiseStatus(_In_ NTSTATUS Status)
VOID NTAPI LdrpUpdateLoadCount2(IN PLDR_DATA_TABLE_ENTRY LdrEntry, IN ULONG Flags)
IN PLARGE_INTEGER IN PLARGE_INTEGER PEPROCESS ProcessId
NTSTATUS NTAPI NtUnmapViewOfSection(IN HANDLE ProcessHandle, IN PVOID BaseAddress)
BOOLEAN LdrpBreakOnRecursiveDllLoads
FORCEINLINE ULONG_PTR LdrpMakeCookie(VOID)
NTSTATUS NTAPI LdrGetDllHandle(IN PWSTR DllPath OPTIONAL, IN PULONG DllCharacteristics OPTIONAL, IN PUNICODE_STRING DllName, OUT PVOID *DllHandle)
NTSTATUS NTAPI LdrSetAppCompatDllRedirectionCallback(_In_ ULONG Flags, _In_ PLDR_APP_COMPAT_DLL_REDIRECTION_CALLBACK_FUNCTION CallbackFunction, _In_opt_ PVOID CallbackData)
_In_ ULONG _In_ ULONG _In_ ULONG Length
IN PUNICODE_STRING IN POBJECT_ATTRIBUTES IN DWORD Unknown3
_IRQL_requires_same_ typedef _In_ ULONG _In_ UCHAR _In_ ULONGLONG _In_ ULONGLONG _In_opt_ PEVENT_FILTER_DESCRIPTOR _Inout_opt_ PVOID CallbackContext
LIST_ENTRY InInitializationOrderModuleList
#define STATUS_INFO_LENGTH_MISMATCH
VOID(NTAPI * PLDR_CALLBACK)(PVOID CallbackContext, PCHAR Name)
#define STATUS_NO_MORE_ENTRIES
#define LDRP_DONT_CALL_FOR_THREADS
NTSTATUS NTAPI NtCreateSection(OUT PHANDLE SectionHandle, IN ACCESS_MASK DesiredAccess, IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL, IN PLARGE_INTEGER MaximumSize OPTIONAL, IN ULONG SectionPageProtection OPTIONAL, IN ULONG AllocationAttributes, IN HANDLE FileHandle OPTIONAL)
NTSTATUS NTAPI LdrUnlockLoaderLock(IN ULONG Flags, IN ULONG Cookie OPTIONAL)
PLDR_DATA_TABLE_ENTRY LdrpLoadedDllHandleCache
#define STATUS_INVALID_PARAMETER
struct _LIST_ENTRY * Blink
#define LDR_COR_OWNS_UNMAP
#define IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
#define FLG_HEAP_ENABLE_TAIL_CHECK
NTSTATUS NTAPI LdrAddRefDll(IN ULONG Flags, IN PVOID BaseAddress)
BOOLEAN NTAPI RtlFreeHeap(IN PVOID HeapHandle, IN ULONG Flags, IN PVOID HeapBase)
NTSTATUS NTAPI LdrDestroyOutOfProcessImage(IN PVOID Image)
LIST_ENTRY InMemoryOrderModuleList
NTSTATUS NTAPI LdrLockLoaderLock(IN ULONG Flags, OUT PULONG Disposition OPTIONAL, OUT PULONG_PTR Cookie OPTIONAL)
NTSYSAPI ULONG __cdecl DbgPrintEx(_In_ ULONG ComponentId, _In_ ULONG Level, _In_z_ _Printf_format_string_ PCSTR Format,...)
NTSYSAPI NTSTATUS NTAPI RtlEnterCriticalSection(_In_ PRTL_CRITICAL_SECTION CriticalSection)
IN PVOID IN PVOID IN USHORT IN USHORT Size
BOOLEAN NTAPI LdrFlushAlternateResourceModules(VOID)
VOID NTAPI LdrpRecordUnloadEvent(_In_ PLDR_DATA_TABLE_ENTRY LdrEntry)
#define STATUS_SXS_KEY_NOT_FOUND
#define LDR_LOCK_LOADER_LOCK_DISPOSITION_INVALID
_Check_return_ _CRTIMP _CONST_RETURN char *__cdecl strrchr(_In_z_ const char *_Str, _In_ int _Ch)
#define InsertTailList(ListHead, Entry)
#define UNICODE_STRING_MAX_BYTES
NTSTATUS NTAPI LdrVerifyImageMatchesChecksum(IN HANDLE FileHandle, IN PLDR_CALLBACK Callback, IN PVOID CallbackContext, OUT PUSHORT ImageCharacteristics)
ULONG LdrpActiveUnloadCount
BOOLEAN NTAPI LdrVerifyMappedImageMatchesChecksum(_In_ PVOID BaseAddress, _In_ SIZE_T NumberOfBytes, _In_ ULONG FileLength)
_In_ PCALLBACK_FUNCTION CallbackFunction
_In_ ACCESS_MASK _In_ POBJECT_ATTRIBUTES _Reserved_ ULONG _In_opt_ PUNICODE_STRING _In_ ULONG _Out_opt_ PULONG Disposition
#define DPFLTR_WARNING_LEVEL
NTSTATUS(NTAPI * PLDR_APP_COMPAT_DLL_REDIRECTION_CALLBACK_FUNCTION)(_In_ ULONG Flags, _In_ PCWSTR DllName, _In_ PCWSTR DllPath OPTIONAL, _Inout_opt_ PULONG DllCharacteristics, _In_ PVOID CallbackData, _Outptr_ PWSTR *EffectiveDllPath)
NTSYSAPI VOID NTAPI RtlCopyUnicodeString(PUNICODE_STRING DestinationString, PUNICODE_STRING SourceString)
#define LDR_LOCK_LOADER_LOCK_DISPOSITION_LOCK_NOT_ACQUIRED
_In_ PVOID _Out_ BOOLEAN * Stop
PVOID g_pfnSE_DllUnloaded
FORCEINLINE BOOLEAN RemoveEntryList(_In_ PLIST_ENTRY Entry)
#define STATUS_INTERNAL_ERROR
#define LDR_LOCK_LOADER_LOCK_FLAG_TRY_ONLY
LDR_MANIFEST_PROBER_ROUTINE * PLDR_MANIFEST_PROBER_ROUTINE
BOOLEAN NTAPI LdrpCheckForLoadedDll(IN PWSTR DllPath, IN PUNICODE_STRING DllName, IN BOOLEAN Flag, IN BOOLEAN RedirectedDll, OUT PLDR_DATA_TABLE_ENTRY *LdrEntry)
NTSTATUS NTAPI LdrCreateOutOfProcessImage(IN ULONG Flags, IN HANDLE ProcessHandle, IN HANDLE DllHandle, IN PVOID Unknown3)
return STATUS_NOT_IMPLEMENTED
long __cdecl _InterlockedIncrement(_Interlocked_operand_ long volatile *_Addend)
#define STATUS_INVALID_PARAMETER_3
NTSTATUS(* NTAPI)(IN PFILE_FULL_EA_INFORMATION EaBuffer, IN ULONG EaLength, OUT PULONG ErrorOffset)
NTSYSAPI NTSTATUS NTAPI RtlLeaveCriticalSection(_In_ PRTL_CRITICAL_SECTION CriticalSection)
_In_ PMEMORY_AREA _In_ PVOID _In_ BOOLEAN Locked
PIMAGE_BASE_RELOCATION NTAPI LdrProcessRelocationBlockLongLong(_In_ ULONG_PTR Address, _In_ ULONG Count, _In_ PUSHORT TypeOffset, _In_ LONGLONG Delta)
PLDR_DATA_TABLE_ENTRY LdrpCurrentDllInitializer
#define LDR_LOCK_LOADER_LOCK_DISPOSITION_LOCK_ACQUIRED
NTSTATUS NTAPI NtMapViewOfSection(IN HANDLE SectionHandle, IN HANDLE ProcessHandle, IN OUT PVOID *BaseAddress, IN ULONG_PTR ZeroBits, IN SIZE_T CommitSize, IN OUT PLARGE_INTEGER SectionOffset OPTIONAL, IN OUT PSIZE_T ViewSize, IN SECTION_INHERIT InheritDisposition, IN ULONG AllocationType, IN ULONG Protect)
#define EXCEPTION_EXECUTE_HANDLER
NTSTATUS NTAPI LdrGetProcedureAddress(IN PVOID BaseAddress, IN PANSI_STRING Name, IN ULONG Ordinal, OUT PVOID *ProcedureAddress)
NTSTATUS NTAPI LdrFindCreateProcessManifest(IN ULONG Flags, IN PVOID Image, IN PVOID IdPath, IN ULONG IdPathLength, IN PVOID OutDataEntry)
#define STATUS_MUI_FILE_NOT_FOUND
#define STATUS_INVALID_PARAMETER_2
_At_(*)(_In_ PWSK_CLIENT Client, _In_opt_ PUNICODE_STRING NodeName, _In_opt_ PUNICODE_STRING ServiceName, _In_opt_ ULONG NameSpace, _In_opt_ GUID *Provider, _In_opt_ PADDRINFOEXW Hints, _Outptr_ PADDRINFOEXW *Result, _In_opt_ PEPROCESS OwningProcess, _In_opt_ PETHREAD OwningThread, _Inout_ PIRP Irp Result)(Mem)) NTSTATUS(WSKAPI *PFN_WSK_GET_ADDRESS_INFO
#define LDR_UNLOCK_LOADER_LOCK_FLAG_RAISE_ON_ERRORS
PVOID NTAPI RtlDecodeSystemPointer(IN PVOID Pointer)
_Reserved_ PVOID Reserved
#define LDRP_UPDATE_DEREFCOUNT
#define RTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_FORMAT_WHISTLER
LDR_ENUM_CALLBACK * PLDR_ENUM_CALLBACK
VOID NTAPI AVrfDllUnloadNotification(IN PLDR_DATA_TABLE_ENTRY LdrEntry)
NTSYSAPI NTSTATUS NTAPI RtlUnicodeStringToAnsiString(PANSI_STRING DestinationString, PUNICODE_STRING SourceString, BOOLEAN AllocateDestinationString)
NTSTATUS NTAPI LdrAccessOutOfProcessResource(IN PVOID Unknown, IN PVOID Image, IN PVOID Unknown1, IN PVOID Unknown2, IN PVOID Unknown3)
PFLT_MESSAGE_WAITER_QUEUE CONTAINING_RECORD(Csq, DEVICE_EXTENSION, IrpQueue)) -> WaiterQ.mLock) _IRQL_raises_(DISPATCH_LEVEL) VOID NTAPI FltpAcquireMessageWaiterLock(_In_ PIO_CSQ Csq, _Out_ PKIRQL Irql)
BOOLEAN NTAPI RtlDllShutdownInProgress(VOID)
#define STATUS_NAME_TOO_LONG
#define LDR_GET_DLL_HANDLE_EX_PIN
#define DLL_PROCESS_DETACH
#define NtCurrentProcess()
#define STATUS_IMAGE_CHECKSUM_MISMATCH
PVOID NTAPI RtlAllocateHeap(IN PVOID HeapHandle, IN ULONG Flags, IN SIZE_T Size)
#define DECLSPEC_HOTPATCH
VOID NTAPI LdrpFinalizeAndDeallocateDataTableEntry(IN PLDR_DATA_TABLE_ENTRY Entry)
BOOLEAN NTAPI LdrUnloadAlternateResourceModule(IN PVOID BaseAddress)
struct _LIST_ENTRY * Flink
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID * BaseAddress
VOID WINAPI SE_DllUnloaded(PLDR_DATA_TABLE_ENTRY LdrEntry)
_Must_inspect_result_ _In_ ULONG Flags
#define NT_SUCCESS(StatCode)
_In_opt_ PVOID _Out_ PLARGE_INTEGER Cookie
PRTL_ACTIVATION_CONTEXT_STACK_FRAME FASTCALL RtlDeactivateActivationContextUnsafeFast(IN PRTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED Frame)
NTSYSAPI VOID NTAPI RtlFreeUnicodeString(PUNICODE_STRING UnicodeString)
NTSTATUS NTAPI LdrpGetProcedureAddress(IN PVOID BaseAddress, IN PANSI_STRING Name, IN ULONG Ordinal, OUT PVOID *ProcedureAddress, IN BOOLEAN ExecuteInit)
_In_ PCWSTR _Out_ PVOID * ActCtx
static BOOL CompareName(LPCWSTR pszName1, LPCWSTR pszName2)
NTSTATUS NTAPI LdrQueryProcessModuleInformation(IN PRTL_PROCESS_MODULES ModuleInformation, IN ULONG Size, OUT PULONG ReturnedSize OPTIONAL)
NTSTATUS NTAPI NtClose(IN HANDLE Handle)
struct _RTL_PROCESS_MODULE_INFORMATION RTL_PROCESS_MODULE_INFORMATION
ULONG NTAPI LdrpClearLoadInProgress(VOID)
PLDR_DATA_TABLE_ENTRY LdrpGetModuleHandleCache
VOID NTAPI LdrSetDllManifestProber(_In_ PLDR_MANIFEST_PROBER_ROUTINE Routine)
#define LDRP_UNLOAD_IN_PROGRESS
#define RtlImageDirectoryEntryToData
PLDR_MANIFEST_PROBER_ROUTINE LdrpManifestProberRoutine
#define STATUS_INVALID_PARAMETER_1
NTSYSAPI NTSTATUS NTAPI RtlDosApplyFileIsolationRedirection_Ustr(IN ULONG Flags, IN PUNICODE_STRING OriginalName, IN PUNICODE_STRING Extension, IN OUT PUNICODE_STRING StaticString, IN OUT PUNICODE_STRING DynamicString, IN OUT PUNICODE_STRING *NewName, IN PULONG NewFlags, IN PSIZE_T FileNameSize, IN PSIZE_T RequiredLength)
PUNICODE_STRING LdrpTopLevelDllBeingLoaded
NTSTATUS NTAPI DECLSPEC_HOTPATCH LdrLoadDll(IN PWSTR SearchPath OPTIONAL, IN PULONG DllCharacteristics OPTIONAL, IN PUNICODE_STRING DllName, OUT PVOID *BaseAddress)
LONG LdrpLoaderLockAcquisitionCount
UNICODE_STRING LdrApiDefaultExtension
NTSTATUS NTAPI LdrEnumerateLoadedModules(IN BOOLEAN ReservedFlag, IN PLDR_ENUM_CALLBACK EnumProc, IN PVOID Context)
NTSTATUS NTAPI NtQueryInformationFile(HANDLE hFile, PIO_STATUS_BLOCK io, PVOID ptr, ULONG len, FILE_INFORMATION_CLASS FileInformationClass)
NTSTATUS NTAPI LdrpLoadDll(IN BOOLEAN Redirected, IN PWSTR DllPath OPTIONAL, IN PULONG DllCharacteristics OPTIONAL, IN PUNICODE_STRING DllName, OUT PVOID *BaseAddress, IN BOOLEAN CallInit)
BOOLEAN LdrpShowRecursiveLoads
_In_ WDFINTERRUPT _In_ PFN_WDF_INTERRUPT_SYNCHRONIZE Callback
LIST_ENTRY InLoadOrderLinks
NTSTATUS NTAPI LdrDisableThreadCalloutsForDll(IN PVOID BaseAddress)
#define STATUS_DLL_INIT_FAILED
NTSTATUS NTAPI LdrUnloadDll(IN PVOID BaseAddress)
BOOLEAN LdrpShutdownInProgress
#define STATUS_OBJECT_NAME_NOT_FOUND
FORCEINLINE struct _TEB * NtCurrentTeb(VOID)
NTSTATUS NTAPI LdrLoadAlternateResourceModule(IN PVOID Module, IN PWSTR Buffer)
#define STATUS_DLL_NOT_FOUND
LIST_ENTRY InMemoryOrderLinks
static const char const char * DllPath
#define InitializeListHead(ListHead)
NTSYSAPI NTSTATUS NTAPI RtlAppendUnicodeStringToString(PUNICODE_STRING Destination, PUNICODE_STRING Source)
#define STATUS_NO_SUCH_FILE
UNICODE_STRING FullDllName
UNICODE_STRING BaseDllName
static OUT PIO_STATUS_BLOCK IoStatusBlock
PACTIVATION_CONTEXT EntryPointActivationContext
NTSTATUS NTAPI LdrQueryProcessModuleInformationEx(IN ULONG ProcessId, IN ULONG Reserved, OUT PRTL_PROCESS_MODULES ModuleInformation, IN ULONG Size, OUT PULONG ReturnedSize OPTIONAL)
#define LDRP_UPDATE_REFCOUNT
#define FileStandardInformation
#define IMAGE_DIRECTORY_ENTRY_IMPORT
PRTL_ACTIVATION_CONTEXT_STACK_FRAME FASTCALL RtlActivateActivationContextUnsafeFast(IN PRTL_CALLER_ALLOCATED_ACTIVATION_CONTEXT_STACK_FRAME_EXTENDED Frame, IN PVOID Context)
#define LDR_GET_DLL_HANDLE_EX_UNCHANGED_REFCOUNT
BOOLEAN NTAPI LdrpCheckForLoadedDllHandle(IN PVOID Base, OUT PLDR_DATA_TABLE_ENTRY *LdrEntry)
_In_ HANDLE _Outptr_result_bytebuffer_ ViewSize PVOID _In_ ULONG_PTR _In_ SIZE_T _Inout_opt_ PLARGE_INTEGER _Inout_ PSIZE_T ViewSize
#define LDR_ADDREF_DLL_PIN
RTL_CRITICAL_SECTION LdrpLoaderLock
#define SECTION_MAP_EXECUTE
static BOOL CALLBACK EnumProc(_In_ HWND hWnd, _In_ LPARAM lParam)
BOOLEAN NTAPI LdrAlternateResourcesEnabled(VOID)
#define RtlZeroMemory(Destination, Length)
#define _SEH2_EXCEPT(...)
#define _SEH2_GetExceptionCode()
_In_ HANDLE ProcessHandle
PIMAGE_BASE_RELOCATION NTAPI LdrProcessRelocationBlock(IN ULONG_PTR Address, IN ULONG Count, IN PUSHORT TypeOffset, IN LONG_PTR Delta)
NTSYSAPI BOOLEAN NTAPI RtlTryEnterCriticalSection(_In_ PRTL_CRITICAL_SECTION CriticalSection)
#define LDRP_PROCESS_ATTACH_CALLED
NTSYSAPI BOOLEAN NTAPI RtlEqualUnicodeString(PUNICODE_STRING String1, PUNICODE_STRING String2, BOOLEAN CaseInSensitive)
NTSTATUS NTAPI LdrFindEntryForAddress(PVOID Address, PLDR_DATA_TABLE_ENTRY *Module)
LIST_ENTRY * ModuleListHead
LIST_ENTRY InInitializationOrderLinks
base of all file and directory entries
BOOLEAN NTAPI LdrpCallInitRoutine(IN PDLL_INIT_ROUTINE EntryPoint, IN PVOID BaseAddress, IN ULONG Reason, IN PVOID Context)
#define RTL_CONSTANT_STRING(s)
LIST_ENTRY LdrpUnloadHead
PULONG MinorVersion OPTIONAL